rea-agents 6.3.0 → 6.5.0

package/dist/application/LinuxHopper.js

@@ -1,14 +1,14 @@
 import { createHash } from "node:crypto";
-import { execFile } from "node:child_process";
 import { createReadStream } from "node:fs";
 import { access, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { promisify } from "node:util";
+import { execFileBoundedOutput } from "../process/ExecFileBoundedOutput.js";
 import { execFileOutput } from "../process/ExecFileOutput.js";
-const execFileAsync = promisify(execFile);
+import { downloadHopperPackage, HOPPER_DOWNLOAD_BYTES, } from "./HopperDownload.js";
+/** Package-manager output retained per stream without stopping the command. */
+const PACKAGE_MANAGER_OUTPUT_BYTES = 64 * 1024;
 const DOWNLOAD_PREFIX = "https://www.hopperapp.com:443/downloader/public/";
-const MAX_PACKAGE_BYTES = 100_000_000;
 const SUPPORTED_HOPPER_SHA256 = new Set([
     "0294ced141cc373468ee22d8343e7dac41980cb05a937994ca81c9f09afe7ded",
     "1339f9e58377442b0c6fcb0dfc3cec20d593cc557408521fad9a00dbc6b8da13",
@@ -37,9 +37,37 @@ export const linuxHopperInstallDisclosure = (family, isRoot) => {
         downloadUrl: release.filename,
         expectedBytes: Number(release.file_length),
         expectedSha1: release.file_hash,
-        commands: linuxPackageManagerCommands(family, `<verified-hopper.${family}>`, isRoot).map(({ executable, args }) => `${executable} ${args.join(" ")}`),
+        commands: linuxPackageManagerCommands(family, `<verified-hopper.${family}>`, isRoot).map(({ executable, args }) => formatCommandForDisplay(executable, args)),
     };
 };
+/**
+ * Whether REA's analysis providers run on this distribution. A recognized
+ * package family means a glibc host with a known package layout, which is what
+ * the providers need; downloading and installing the official Hopper package
+ * additionally requires a distribution on its tested list.
+ */
+export const supportsReaHost = (distribution) => distribution?.packageFamily !== undefined;
+/** Own failed temporary cleanup until a later retry succeeds. */
+export class LinuxHopperTemporaryCleanupOwner {
+    pending = new Map();
+    retain(failure) {
+        this.pending.set(failure.path, failure);
+    }
+    async retry(cleanup) {
+        const failures = [];
+        for (const path of this.pending.keys()) {
+            try {
+                await cleanup(path);
+                this.pending.delete(path);
+            }
+            catch (cause) {
+                const reason = cause instanceof Error ? cause.message : String(cause);
+                failures.push(`Linux Hopper temporary cleanup failed for ${path}: ${reason}`);
+            }
+        }
+        return failures.length === 0 ? undefined : failures.join("; ");
+    }
+}
 /** Parse an os-release document without executing its shell syntax. */
 export const parseLinuxDistribution = (text) => {
     const fields = new Map();
@@ -51,17 +79,22 @@ export const parseLinuxDistribution = (text) => {
         const encoded = match[2];
         if (key === undefined || encoded === undefined)
             continue;
-        const value = encoded.startsWith('"') && encoded.endsWith('"')
-            ? encoded.slice(1, -1).replaceAll('\\"', '"').replaceAll("\\\\", "\\")
-            : encoded;
+        const quote = encoded[0];
+        const quoted = (quote === "'" || quote === '"') && encoded.endsWith(quote);
+        const value = !quoted
+            ? encoded
+            : quote === "'"
+                ? encoded.slice(1, -1)
+                : encoded.slice(1, -1).replace(/\\(["\\$`])/gu, "$1");
         fields.set(key, value);
     }
     const id = (fields.get("ID") ?? "unknown").toLowerCase();
     const versionId = fields.get("VERSION_ID");
     const packageFamily = packageFamilyFor(id, fields.get("ID_LIKE"));
-    const supported = packageFamily !== undefined &&
+    const hopperSetupSupported = packageFamily !== undefined &&
         (id === "arch" ||
             id === "cachyos" ||
+            (id === "omarchy" && packageFamily === "arch") ||
             (id === "ubuntu" && versionAtLeast(versionId, 24)) ||
             (id === "fedora" && versionAtLeast(versionId, 41)) ||
             (id === "nobara" && versionAtLeast(versionId, 44)));
@@ -69,9 +102,9 @@ export const parseLinuxDistribution = (text) => {
         id,
         ...(versionId === undefined ? {} : { versionId }),
     };
-    return supported
-        ? { ...identity, packageFamily, supported: true }
-        : { ...identity, packageFamily, supported: false };
+    return hopperSetupSupported
+        ? { ...identity, packageFamily, hopperSetupSupported: true }
+        : { ...identity, packageFamily, hopperSetupSupported: false };
 };
 /** Read and classify the current Linux distribution. */
 export const readLinuxDistribution = async () => {
@@ -89,55 +122,79 @@ export const installLinuxHopper = async (host = systemLinuxHopperInstallHost(pro
     if (options.signal?.aborted === true)
         return { status: "failed", reason: "cancelled" };
     const distribution = await host.distribution();
-    if (distribution?.supported !== true)
+    if (distribution?.hopperSetupSupported !== true)
         return { status: "failed", reason: "unsupported_host" };
     let temporary;
+    let result;
     try {
-        const release = (options.releases ?? SUPPORTED_RELEASES)[distribution.packageFamily];
-        const archiveDownload = await host.download(release.filename, options);
-        if (!archiveDownload.ok)
-            return { status: "failed", reason: "download" };
-        if (!packageIntegrityMatches(archiveDownload.bytes, release))
-            return { status: "failed", reason: "integrity" };
-        temporary = await host.createTemporaryDirectory();
-        const archive = join(temporary, `hopper.${distribution.packageFamily}`);
-        await host.writeArchive(archive, archiveDownload.bytes);
-        if (!(await host.installPackage(distribution.packageFamily, archive)))
-            return { status: "failed", reason: "authorization_or_package_manager" };
-        const launcherPath = "/opt/hopper/bin/Hopper";
-        const launcherStatus = await host.launcherStatus(launcherPath);
-        if (launcherStatus !== "ready")
-            return {
-                status: "failed",
-                reason: launcherStatus === "missing" ? "launcher_missing" : launcherStatus,
-            };
-        return { status: "installed", launcherPath };
+        result = await (async () => {
+            const release = (options.releases ?? SUPPORTED_RELEASES)[distribution.packageFamily];
+            const archiveDownload = await host.download(release.filename, options);
+            if (!archiveDownload.ok)
+                return { status: "failed", reason: "download" };
+            if (!packageIntegrityMatches(archiveDownload.bytes, release))
+                return { status: "failed", reason: "integrity" };
+            temporary = await host.createTemporaryDirectory();
+            const archive = join(temporary, `hopper.${distribution.packageFamily}`);
+            await host.writeArchive(archive, archiveDownload.bytes);
+            const install = await host.installPackage(distribution.packageFamily, archive);
+            if (install.status === "failed")
+                return {
+                    status: "failed",
+                    reason: "authorization_or_package_manager",
+                    packageFailure: install.failure,
+                };
+            const launcherPath = "/opt/hopper/bin/Hopper";
+            const launcherStatus = await host.launcherStatus(launcherPath);
+            if (launcherStatus !== "ready")
+                return {
+                    status: "failed",
+                    reason: launcherStatus === "missing" ? "launcher_missing" : launcherStatus,
+                };
+            return { status: "installed", launcherPath };
+        })();
     }
     catch (cause) {
-        if (isAbortCause(cause))
-            return { status: "failed", reason: "cancelled" };
-        return { status: "failed", reason: "download" };
+        result = {
+            status: "failed",
+            reason: isAbortCause(cause) ? "cancelled" : "download",
+        };
     }
-    finally {
-        if (temporary !== undefined)
-            await host.cleanup(temporary);
+    if (temporary === undefined)
+        return result;
+    try {
+        await host.cleanup(temporary);
+        return result;
+    }
+    catch (cause) {
+        return {
+            ...result,
+            cleanupFailure: {
+                path: temporary,
+                reason: cause instanceof Error ? cause.message : String(cause),
+            },
+        };
     }
 };
 /** Canonical launcher path for a legacy user-local Linux Hopper installation. */
 export const linuxHopperLauncherPath = (home) => join(home, ".local/share/rea/hopper/bin/Hopper");
+/** REA's managed Linux install path, preferred when no explicit launcher is set. */
+export const REA_MANAGED_LINUX_HOPPER_LAUNCHER = "/opt/hopper/bin/Hopper";
+/** Other system-wide Hopper paths used by package installations. */
+export const systemLinuxHopperLauncherCandidates = [
+    "/opt/hopper-v4/bin/hopper",
+    "/usr/bin/hopper",
+];
+/** Probe REA-managed and user-local installs before arbitrary system builds. */
+export const linuxHopperLauncherCandidates = (home) => [
+    REA_MANAGED_LINUX_HOPPER_LAUNCHER,
+    linuxHopperLauncherPath(home),
+    ...systemLinuxHopperLauncherCandidates,
+];
 /** Compose package-manager and linker checks from the selected caller environment. */
 export const systemLinuxHopperInstallHost = (environment) => ({
     distribution: readLinuxDistribution,
-    async download(url, options) {
-        const response = await fetch(url, {
-            headers: { accept: "application/json", "user-agent": "rea-installer" },
-            ...(options.signal === undefined ? {} : { signal: options.signal }),
-        });
-        return {
-            ok: response.ok,
-            bytes: new Uint8Array(await response.arrayBuffer()),
-        };
-    },
+    download: downloadHopperPackage,
     createTemporaryDirectory: () => mkdtemp(join(tmpdir(), "rea-hopper-")),
     writeArchive: (path, bytes) => writeFile(path, bytes, { mode: 0o600 }),
     installPackage: (family, archive) => installSystemPackage(family, archive, environment),
@@ -178,19 +235,32 @@ export const linuxHopperLauncherDigestSupported = (digest) => SUPPORTED_HOPPER_S
 /** Interpret ldd output conservatively so a present but broken launcher is unhealthy. */
 export const linuxSharedLibrariesAvailable = (output) => !/(?:=>\s+not found|error while loading shared libraries)/iu.test(output);
 const installSystemPackage = async (family, archive, environment) => {
-    try {
-        for (const command of linuxPackageManagerCommands(family, archive, process.getuid?.() === 0))
-            await execFileAsync(command.executable, command.args, {
-                env: environment,
-            });
-        return true;
-    }
-    catch (cause) {
-        // Package-manager failure is reported by the false return.
-        void cause;
-        return false;
+    for (const command of linuxPackageManagerCommands(family, archive, process.getuid?.() === 0)) {
+        const output = await execFileBoundedOutput(command.executable, command.args, {
+            env: environment,
+            limit: PACKAGE_MANAGER_OUTPUT_BYTES,
+        });
+        if (output.exitCode !== 0) {
+            return {
+                status: "failed",
+                failure: {
+                    command: formatCommandForDisplay(command.executable, command.args),
+                    exitCode: output.exitCode,
+                    // The streams stay separate; their original interleaved order
+                    // is not recoverable after capture.
+                    stdout: output.stdout,
+                    stderr: output.stderr,
+                    outputTruncated: output.outputTruncated,
+                },
+            };
+        }
     }
+    return { status: "installed" };
 };
+/** Preserve argument boundaries in a command shown to the user. */
+export const formatCommandForDisplay = (executable, args) => [executable, ...args]
+    .map((part) => /^[A-Za-z0-9_./:@%+=,-]+$/u.test(part) ? part : JSON.stringify(part))
+    .join(" ");
 /** Select the native package manager and authorization boundary without shell evaluation. */
 export const linuxPackageManagerCommands = (family, archive, isRoot) => {
     const runtimeDependencies = family === "deb"
@@ -220,7 +290,7 @@ export const linuxPackageManagerCommands = (family, archive, isRoot) => {
     });
 };
 const packageIntegrityMatches = (bytes, release) => bytes.byteLength === Number(release.file_length) &&
-    bytes.byteLength <= MAX_PACKAGE_BYTES &&
+    bytes.byteLength <= HOPPER_DOWNLOAD_BYTES &&
     createHash("sha1").update(bytes).digest("hex") === release.file_hash;
 const packageFamilyFor = (id, idLike) => {
     const identities = new Set([

package/dist/application/MacHopper.js

@@ -6,17 +6,21 @@ import { join } from "node:path";
 import { promisify } from "node:util";
 import { z } from "zod";
 import { homeDirectoryFromEnvironment } from "../config/homeDirectory.js";
+import { HOPPER_PUBLISHER } from "../domain/hopperPublisher.js";
+import { macDeveloperIdRequirement } from "../process/MacCodeSignature.js";
+import { macHopperUserApplicationPath } from "./MacHopperPaths.js";
+import { downloadHopperPackage, HOPPER_DOWNLOAD_BYTES, } from "./HopperDownload.js";
 const execFileAsync = promisify(execFile);
 const RELEASES_URL = "https://www.hopperapp.com/include/files-api.php?request=releases&public=true";
 const DOWNLOAD_PREFIX = "https://www.hopperapp.com:443/downloader/public/";
-const MAX_PACKAGE_BYTES = 100_000_000;
-const BUNDLE_IDENTIFIER = "com.cryptic-apps.hopper-web-4";
+const HOPPER_PUBLISHER_REQUIREMENT = macDeveloperIdRequirement(HOPPER_PUBLISHER.bundleIdentifier, HOPPER_PUBLISHER.teamIdentifier);
 /** Stable network and command effects disclosed before macOS Hopper setup. */
 export const macHopperInstallDisclosure = {
     networkOrigins: [RELEASES_URL, DOWNLOAD_PREFIX],
     commands: [
         "hdiutil attach -readonly -nobrowse -mountpoint <private-mount> <verified-hopper.dmg>",
         "codesign --verify --deep --strict <mounted-hopper.app>",
+        `codesign --verify --strict '-R${HOPPER_PUBLISHER_REQUIREMENT}' <mounted-hopper.app>`,
         "ditto <mounted-hopper.app> <user-Applications-stage>",
         "open <installed-hopper.app>",
     ],
@@ -25,173 +29,195 @@ export const macHopperInstallDisclosure = {
 export const installMacHopper = async (options = {}, host = systemMacHopperInstallHost(homeDirectoryFromEnvironment(process.env, process.platform), process.env)) => {
     let temporary;
     let mounted = false;
+    let result;
     try {
-        const metadata = await host.download(RELEASES_URL);
-        if (!metadata.ok)
-            return { status: "failed", reason: "release_metadata" };
-        const parsed = releasesSchema.safeParse(parseJson(metadata.bytes));
-        if (!parsed.success)
-            return { status: "failed", reason: "release_metadata" };
-        const release = parsed.data["OS X"];
-        if (!release.filename.startsWith(DOWNLOAD_PREFIX))
-            return { status: "failed", reason: "release_metadata" };
-        const archive = await host.download(release.filename);
-        if (!archive.ok)
-            return { status: "failed", reason: "download" };
-        if (!integrityMatches(archive.bytes, release))
-            return { status: "failed", reason: "integrity" };
-        const destination = host.destination();
-        const destinationExists = await host.destinationExists(destination);
-        if (destinationExists && options.replaceExisting !== true)
-            return { status: "failed", reason: "destination_exists" };
-        temporary = await host.createTemporaryDirectory();
-        const packagePath = join(temporary, "hopper.dmg");
-        const mountPath = join(temporary, "mounted");
-        await host.createMountDirectory(mountPath);
-        await host.writePackage(packagePath, archive.bytes);
-        if (!(await host.mount(packagePath, mountPath)))
-            return { status: "failed", reason: "mount" };
-        mounted = true;
-        const source = await host.appBundle(mountPath);
-        if (source === undefined || !(await host.validBundle(source)))
-            return { status: "failed", reason: "bundle" };
-        const stage = `${destination}.rea-stage`;
-        if (!(await host.installBundle(source, destination, stage, destinationExists)))
-            return { status: "failed", reason: "copy" };
-        const launcherPath = join(destination, "Contents/MacOS/hopper");
-        if (!(await host.launcherReady(launcherPath)))
-            return { status: "failed", reason: "launcher_missing" };
-        await host.openApplication(destination);
-        return { status: "installed", launcherPath };
+        result = await (async () => {
+            const metadata = await host.download(RELEASES_URL);
+            if (!metadata.ok)
+                return { status: "failed", reason: "release_metadata" };
+            const parsed = releasesSchema.safeParse(parseJson(metadata.bytes));
+            if (!parsed.success)
+                return { status: "failed", reason: "release_metadata" };
+            const release = parsed.data["OS X"];
+            if (!release.filename.startsWith(DOWNLOAD_PREFIX))
+                return { status: "failed", reason: "release_metadata" };
+            const archive = await host.download(release.filename);
+            if (!archive.ok)
+                return { status: "failed", reason: "download" };
+            if (!integrityMatches(archive.bytes, release))
+                return { status: "failed", reason: "integrity" };
+            const destination = host.destination();
+            const destinationExists = await host.destinationExists(destination);
+            if (destinationExists && options.replaceExisting !== true)
+                return { status: "failed", reason: "destination_exists" };
+            temporary = await host.createTemporaryDirectory();
+            const packagePath = join(temporary, "hopper.dmg");
+            const mountPath = join(temporary, "mounted");
+            await host.createMountDirectory(mountPath);
+            await host.writePackage(packagePath, archive.bytes);
+            if (!(await host.mount(packagePath, mountPath)))
+                return { status: "failed", reason: "mount" };
+            mounted = true;
+            const source = await host.appBundle(mountPath);
+            if (source === undefined)
+                return { status: "failed", reason: "bundle" };
+            const verification = await host.validBundle(source);
+            if (verification === "invalid_signature")
+                return { status: "failed", reason: "bundle" };
+            if (verification === "unverified_publisher")
+                return { status: "failed", reason: "publisher_verification_failed" };
+            const stage = `${destination}.rea-stage`;
+            if (!(await host.installBundle(source, destination, stage, destinationExists)))
+                return { status: "failed", reason: "copy" };
+            const launcherPath = join(destination, "Contents/MacOS/hopper");
+            if (!(await host.launcherReady(launcherPath)))
+                return { status: "failed", reason: "launcher_missing" };
+            await host.openApplication(destination);
+            return { status: "installed", launcherPath };
+        })();
     }
     catch (cause) {
         // Install-stage failures share the download reason; the stage is cleaned below.
         void cause;
-        return { status: "failed", reason: "download" };
+        result = { status: "failed", reason: "download" };
     }
-    finally {
-        if (temporary !== undefined) {
-            const mountPath = join(temporary, "mounted");
-            if (mounted)
+    let cleanupFailure;
+    if (temporary !== undefined) {
+        const temporaryPath = temporary;
+        const mountPath = join(temporary, "mounted");
+        const cleanup = async () => {
+            if (mounted) {
                 await host.unmount(mountPath);
-            await host.cleanup(temporary);
-        }
-    }
-};
-/** Compose installer paths and subprocesses from one selected caller context. */
-export const systemMacHopperInstallHost = (homeDirectory, environment) => ({
-    download: downloadPackage,
-    createTemporaryDirectory: () => mkdtemp(join(tmpdir(), "rea-hopper-mac-")),
-    createMountDirectory: (path) => mkdir(path),
-    writePackage: (path, bytes) => writeFile(path, bytes, { mode: 0o600 }),
-    async mount(packagePath, mountPath) {
-        return commandSucceeds("hdiutil", [
-            "attach",
-            "-readonly",
-            "-nobrowse",
-            "-mountpoint",
-            mountPath,
-            packagePath,
-        ], environment);
-    },
-    async unmount(mountPath) {
-        await commandSucceeds("hdiutil", ["detach", mountPath, "-force"], environment);
-    },
-    async appBundle(mountPath) {
-        const entries = await readdir(mountPath, { withFileTypes: true });
-        const app = entries.find((entry) => entry.isDirectory() && /^Hopper.*\.app$/iu.test(entry.name));
-        return app === undefined ? undefined : join(mountPath, app.name);
-    },
-    async validBundle(appPath) {
-        if (!(await commandSucceeds("codesign", ["--verify", "--deep", "--strict", appPath], environment)))
-            return false;
-        try {
-            const identifier = (await execFileAsync("/usr/libexec/PlistBuddy", [
-                "-c",
-                "Print :CFBundleIdentifier",
-                join(appPath, "Contents/Info.plist"),
-            ], { env: environment })).stdout.trim();
-            return identifier === BUNDLE_IDENTIFIER;
-        }
-        catch (cause) {
-            // best-effort cleanup: optional bundle probing; unreadable means invalid.
-            void cause;
-            return false;
-        }
-    },
-    async destinationExists(path) {
+                mounted = false;
+            }
+            await host.cleanup(temporaryPath);
+        };
         try {
-            await access(path);
-            return true;
+            await cleanup();
         }
         catch (cause) {
-            // best-effort cleanup: optional existence probing; absence means missing.
-            void cause;
-            return false;
+            cleanupFailure = `Hopper DMG cleanup failed: ${failureMessage(cause)}`;
+            host.retainCleanup?.(cleanup);
         }
-    },
-    async installBundle(source, destination, stage, replaceExisting) {
-        const previous = `${stage}-previous`;
-        try {
-            await mkdir(join(homeDirectory, "Applications"), { recursive: true });
-            await rm(stage, { recursive: true, force: true });
-            await rm(previous, { recursive: true, force: true });
-            await execFileAsync("ditto", [source, stage], { env: environment });
-            await access(join(stage, "Contents/MacOS/hopper"));
-            if (replaceExisting)
-                await rename(destination, previous);
-            await rename(stage, destination);
-            if (replaceExisting)
+    }
+    return cleanupFailure === undefined ? result : { ...result, cleanupFailure };
+};
+/** Compose installer paths and subprocesses from one selected caller context. */
+export const systemMacHopperInstallHost = (homeDirectory, environment) => {
+    const pendingCleanup = new Set();
+    return {
+        download: downloadHopperPackage,
+        createTemporaryDirectory: () => mkdtemp(join(tmpdir(), "rea-hopper-mac-")),
+        createMountDirectory: (path) => mkdir(path),
+        writePackage: (path, bytes) => writeFile(path, bytes, { mode: 0o600 }),
+        async mount(packagePath, mountPath) {
+            return commandSucceeds("hdiutil", [
+                "attach",
+                "-readonly",
+                "-nobrowse",
+                "-mountpoint",
+                mountPath,
+                packagePath,
+            ], environment);
+        },
+        async unmount(mountPath) {
+            if (!(await commandSucceeds("hdiutil", ["detach", mountPath, "-force"], environment)))
+                throw new Error(`hdiutil detach failed for ${JSON.stringify(mountPath)}`);
+        },
+        async appBundle(mountPath) {
+            const entries = await readdir(mountPath, { withFileTypes: true });
+            const app = entries.find((entry) => entry.isDirectory() && /^Hopper.*\.app$/iu.test(entry.name));
+            return app === undefined ? undefined : join(mountPath, app.name);
+        },
+        async validBundle(appPath) {
+            if (!(await commandSucceeds("codesign", ["--verify", "--deep", "--strict", appPath], environment)))
+                return "invalid_signature";
+            if (!(await commandSucceeds("codesign", [
+                "--verify",
+                "--strict",
+                `-R${HOPPER_PUBLISHER_REQUIREMENT}`,
+                appPath,
+            ], environment)))
+                return "unverified_publisher";
+            return "verified";
+        },
+        async destinationExists(path) {
+            try {
+                await access(path);
+                return true;
+            }
+            catch (cause) {
+                // best-effort cleanup: optional existence probing; absence means missing.
+                void cause;
+                return false;
+            }
+        },
+        async installBundle(source, destination, stage, replaceExisting) {
+            const previous = `${stage}-previous`;
+            try {
+                await mkdir(join(homeDirectory, "Applications"), { recursive: true });
+                await rm(stage, { recursive: true, force: true });
                 await rm(previous, { recursive: true, force: true });
-            return true;
-        }
-        catch (cause) {
-            // Install failure rolls back below; the false return reports it.
-            void cause;
-            await rm(stage, { recursive: true, force: true });
-            if (replaceExisting) {
+                await execFileAsync("ditto", [source, stage], { env: environment });
+                await access(join(stage, "Contents/MacOS/hopper"));
+                if (replaceExisting)
+                    await rename(destination, previous);
+                await rename(stage, destination);
+                if (replaceExisting)
+                    await rm(previous, { recursive: true, force: true });
+                return true;
+            }
+            catch (cause) {
+                // Install failure rolls back below; the false return reports it.
+                void cause;
+                await rm(stage, { recursive: true, force: true });
+                if (replaceExisting) {
+                    try {
+                        await rename(previous, destination);
+                    }
+                    catch (rollbackCause) {
+                        // The original destination was not moved, or rollback is impossible.
+                        void rollbackCause;
+                    }
+                }
+                return false;
+            }
+        },
+        async launcherReady(path) {
+            try {
+                await access(path);
+                return true;
+            }
+            catch (cause) {
+                // best-effort cleanup: optional launcher probing; absence means not ready.
+                void cause;
+                return false;
+            }
+        },
+        async openApplication(path) {
+            await execFileAsync("open", [path], { env: environment });
+        },
+        cleanup: (path) => rm(path, { recursive: true, force: true }),
+        retainCleanup: (cleanup) => pendingCleanup.add(cleanup),
+        async close() {
+            let failure;
+            for (const cleanup of pendingCleanup) {
                 try {
-                    await rename(previous, destination);
+                    await cleanup();
+                    pendingCleanup.delete(cleanup);
                 }
-                catch (rollbackCause) {
-                    // The original destination was not moved, or rollback is impossible.
-                    void rollbackCause;
+                catch (cause) {
+                    failure ??= `Hopper DMG cleanup remains incomplete: ${failureMessage(cause)}`;
                 }
             }
-            return false;
-        }
-    },
-    async launcherReady(path) {
-        try {
-            await access(path);
-            return true;
-        }
-        catch (cause) {
-            // best-effort cleanup: optional launcher probing; absence means not ready.
-            void cause;
-            return false;
-        }
-    },
-    async openApplication(path) {
-        await execFileAsync("open", [path], { env: environment });
-    },
-    cleanup: (path) => rm(path, { recursive: true, force: true }),
-    destination: () => join(homeDirectory, "Applications/Hopper Disassembler.app"),
-});
-const downloadPackage = async (url) => {
-    const response = await fetch(url, {
-        headers: { accept: "application/json", "user-agent": "rea-installer" },
-        signal: AbortSignal.timeout(120_000),
-    });
-    const length = Number(response.headers.get("content-length") ?? "0");
-    if (length > MAX_PACKAGE_BYTES)
-        return { ok: false, bytes: new Uint8Array() };
-    const bytes = new Uint8Array(await response.arrayBuffer());
-    return { ok: response.ok && bytes.byteLength <= MAX_PACKAGE_BYTES, bytes };
+            return failure;
+        },
+        destination: () => macHopperUserApplicationPath(homeDirectory),
+    };
 };
 const parseJson = (bytes) => JSON.parse(new TextDecoder().decode(bytes));
 const integrityMatches = (bytes, release) => bytes.byteLength === Number(release.file_length) &&
-    bytes.byteLength <= MAX_PACKAGE_BYTES &&
+    bytes.byteLength <= HOPPER_DOWNLOAD_BYTES &&
     createHash("sha1").update(bytes).digest("hex") === release.file_hash;
 const commandSucceeds = async (command, args, environment) => {
     try {
@@ -204,6 +230,7 @@ const commandSucceeds = async (command, args, environment) => {
         return false;
     }
 };
+const failureMessage = (cause) => cause instanceof Error ? cause.message : String(cause);
 const releaseSchema = z.object({
     filename: z.string().url(),
     file_length: z.string().regex(/^\d+$/u),